unclassified-dotnet: eea0dcbc — Stolen-cert attendance tracker masquerading as payment document

Executive Summary

A benign .NET Framework 4.0 WPF/WinForms attendance-tracking application (AttendanceTracker / WpfUI / zOYY.exe) repackaged with a social-engineering filename (PAYMENT_CANCELLED_AND_RETURNED.PDF.exe) and signed with a stolen Authenticode certificate belonging to Simon Tatham, the PuTTY developer. No malicious payload, no C2, no persistence, no injection. The threat is purely the masquerade and the stolen certificate lending false legitimacy. ^[file.txt] ^[exiftool.json]

What It Is

The binary is a standard .NET Framework 4.0 GUI application with no obfuscation, no packing, and no anti-analysis. It was compiled with the standard C# compiler (csc.exe) targeting .NET 4.0. The high .text entropy (7.88) is from compiled CIL bytecode and embedded BAML/XAML resources, not encryption. ^[pefile.txt:92]

How It Works

Application Functionality

The binary is a legitimate attendance-tracking application with the following benign functionality:

• WPF MVVM UI with MainUI, MainUiViewModel, RelayCommand, ViewModelBase, and BooleanToVisibilityConverter ^[strings.txt:24,180-255]
• WinForms interop via ElementHost embedding a Form1 with TreeView, TabControl, DateTimePicker, NotifyIcon, and Splitter controls ^[strings.txt:12-18,28-30]
• Attendance tracking with CheckInOut, RecordAttendance, EnterCheckInOut, calculateHours, getOnlyDate, getOnlyTime, getMonthName ^[strings.txt:51-57,180]
• XML data persistence via XMLReadWrite, initializeXMLFile, cleanUpExistingFile ^[strings.txt:68-69,108]
• Session event handling for SessionEnding and SessionSwitch via Microsoft.Win32.SystemEvents ^[strings.txt:152-163]

External References (TypeRef / MemberRef)

All API references are to standard .NET Framework libraries: ^[strings.txt:20-30,148-217]

• System.Windows.Forms — WinForms controls and events
• PresentationCore / PresentationFramework / WindowsBase — WPF
• System.Xml.Linq — XML data handling
• System.IO — file operations
• System.Drawing — bitmap/image processing (GetPixel, ProcessBitmap, ProcessRow, AddFullPixelData) ^[strings.txt:78-80,183,228-229]

No network APIs (WebClient, HttpWebRequest, Socket, TcpClient), no process injection APIs (CreateRemoteThread, VirtualAllocEx), no registry persistence APIs, and no credential APIs are imported. ^[MemberRef-table]

Certificate Abuse

The binary carries a structurally valid Authenticode signature (WIN_CERTIFICATE type 0x0002, PKCS#7 SignedData, 13,832 bytes) chained through COMODO RSA Code Signing CA → COMODO RSA Certification Authority. ^[pefile.txt:152-188] The end-entity certificate lists:

• Subject: CN=Simon Tatham, O=Simon Tatham, L=Cambridge, ST=Cambridgeshire, C=GB
• URL in cert: https://www.chiark.greenend.org.uk/~sgtatham/putty/ ^[certificate-strings]

This is the well-known signing certificate of Simon Tatham, author of PuTTY. The certificate has been stolen or compromised and repurposed to sign this unrelated attendance-tracker binary, lending it false legitimacy when distributed as PAYMENT_CANCELLED_AND_RETURNED.PDF.exe.

Decompiled Behavior

No Ghidra decompilation was performed — the binary is a standard .NET CIL assembly with no native code. Static analysis of the .NET metadata tables reveals:

TypeDef Table (14 types)

MethodDef Table (83 methods)

Notable methods with their CIL RVAs: ^[MethodDef-table]

• Main (RVA 0x23e7) — STAThread entry point, launches Application.Run(new Form1())
• RecordAttendance (RVA 0x2efd) — Writes attendance record to XML
• ProcessBitmap (RVA 0x303c) / ProcessRow (RVA 0x306c) / AddFullPixelData (RVA 0x3125) — Bitmap pixel processing for UI
• initializeXMLFile (RVA 0x2b48) — Creates/initializes XML data file
• calculateHours (RVA 0x2de0) — Computes hours worked from check-in/out times
• Trif32 (RVA 0x3014) — Unknown helper, possibly image-format related

All methods use standard .NET CIL opcodes (call, callvirt, ldfld, stfld, newobj, ret) with no P/Invoke, no unsafe code blocks, and no Assembly.Load or reflection-based payload loading.

Embedded Resources

Six PNG images are embedded in the .rsrc section: ^[binwalk.txt]

Also: one 130×129×32 BMP and one XML manifest (0xC3EEB, 490 bytes). ^[binwalk.txt]

C2 Infrastructure

None observed. No hardcoded IPs, domains, URLs, mutexes, named pipes, or registry keys. The only URLs in the binary are:

• http://schemas.microsoft.com/winfx/2006/xaml/presentation — WPF XAML namespace ^[strings.txt:644]
• http://schemas.microsoft.com/winfx/2006/xaml — XAML namespace ^[strings.txt:646]
• http://schemas.openxmlformats.org/markup-compatibility/2006 — XAML compatibility ^[strings.txt:647]
• http://schemas.microsoft.com/expression/blend/2008 — Blend designer namespace ^[strings.txt:648]
• Certificate chain CRL/OCSP URLs (COMODO, UserTrust) ^[certificate-strings]

Interesting Tidbits

• Stolen PuTTY certificate: The signer CN Simon Tatham with URL https://www.chiark.greenend.org.uk/~sgtatham/putty/ is the genuine PuTTY developer. This certificate has been repurposed for malware distribution. ^[certificate-strings]
• Triple-identity assembly: The assembly claims three internal names — WpfUI (product name), zOYY.exe (internal filename), and AttendanceTracker (namespace). The dissonance between these names and the distribution filename (PAYMENT_CANCELLED_AND_RETURNED.PDF.exe) is a clear indicator of repackaging. ^[exiftool.json:38-44] ^[metadata.json:5]
• No obfuscation, no packing: The binary is completely unobfuscated. All strings, type names, method names, and resource names are in plaintext. Any .NET decompiler (ILSpy, dnSpy, dotPeek) would recover near-source-quality C# in seconds. ^[capa.txt]
• False-positive capa hits: T1620 (Reflective Code Loading) and T1083 (File and Directory Discovery) are triggered by .NET's natural assembly-loading mechanics and legitimate file I/O, not by malicious behavior. ^[capa.txt]
• No CAPE detonation: The sandbox was skipped because no Windows guest was available. Static analysis is sufficient to determine benignity. ^[dynamic-analysis.md]
• Build date vs. lure theme: Compiled September 2024, distributed with a payment-cancellation lure. The binary is not freshly built for the campaign — it is a repurposed existing application.

How To Mess With It (Homelab Replication)

This is a benign application, so "replication" here means recognizing the pattern.

Toolchain

• Compiler: Visual Studio / MSBuild targeting .NET Framework 4.0
• Project type: WPF Application with Windows Forms Integration (WindowsFormsIntegration reference)
• Output: zOYY.exe (or any name)

Working Source Snippet

Create a minimal WPF + WinForms interop app in Visual Studio:

1. New Project → WPF App (.NET Framework 4.0)
2. Add reference to WindowsFormsIntegration and System.Windows.Forms
3. Add an ElementHost to the WPF XAML
4. Embed a NotifyIcon, TreeView, and DateTimePicker in the WinForms host
5. Add XML persistence via System.Xml.Linq.XDocument

Verification Step

Run capa <your_app.exe> and observe the same false-positive pattern:

• load-code/dotnet and invoke .NET assembly method (normal .NET behavior)
• host-interaction/file-system/exists and host-interaction/file-system/delete (from XML temp file handling)
• anti-analysis::reference analysis tools strings (from DebuggerBrowsableAttribute compiler emission)

Compare to this sample's capa.txt — the hits are identical in namespace but benign in intent. ^[capa.txt]

What You'll Learn

How .NET compiler-generated attributes and standard library calls can trigger capa/ATT&CK mappings that look threatening but are actually benign. This is critical for avoiding false positives in automated triage pipelines.

Deployable Signatures

YARA Rule

rule Stolen_PuTTY_Cert_AttendanceTracker
{
    meta:
        description = "Detects binaries signed with Simon Tatham's stolen PuTTY certificate"
        author = "PacketPursuit"
        date = "2026-06-19"
        sha256 = "eea0dcbc84b2e7113b9110e2f50fdf830c9f6ba67cad97bbe648270b810d757a"
        reference = "https://www.chiark.greenend.org.uk/~sgtatham/putty/"

    strings:
        $cert_cn = "Simon Tatham" ascii wide
        $cert_url = "chiark.greenend.org.uk/~sgtatham/putty" ascii wide
        $attendance1 = "AttendanceTracker" ascii wide
        $attendance2 = "RecordAttendance" ascii wide
        $attendance3 = "CheckInOut" ascii wide
        $wpf1 = "WpfUI" ascii wide
        $wpf2 = "zOYY.exe" ascii wide
        $dotnet = "v4.0.30319" ascii wide

    condition:
        uint16(0) == 0x5A4D and
        ($cert_cn and $cert_url) and
        (2 of ($attendance*)) and
        (1 of ($wpf*)) and
        $dotnet
}

Sigma Rule

title: Stolen PuTTY Certificate Signing Suspicious .NET Binary
logsource:
    product: windows
    category: image_load
detection:
    selection:
        - ImageLoaded|endswith:
            - 'PAYMENT_CANCELLED_AND_RETURNED.PDF.exe'
            - 'zOYY.exe'
        - Company|contains:
            - 'Simon Tatham'
        - Description|contains:
            - 'WpfUI'
    condition: selection
falsepositives:
    - Legitimate PuTTY installers (verify against known-good hashes)
level: high

IOC List

Behavioral Fingerprint Statement

This binary is a .NET Framework 4.0 WPF/WinForms GUI application with no network, injection, or persistence APIs. It reads and writes local XML files for attendance tracking, embeds multiple PNG icon resources, and carries a structurally valid Authenticode signature issued to "Simon Tatham" (the PuTTY developer). When distributed with a payment-document lure filename, the combination of benign application behavior + stolen legitimate certificate is the primary detection signal. The absence of any network connections, registry modifications, or process-creation events after launch confirms the binary is not actively malicious — the threat is the social-engineering wrapper and the stolen certificate.

Detection Signatures

capa → ATT&CK Mapping (with false-positive notes)

No legitimate ATT&CK mappings apply. The binary is benign.

References

• Artifact ID: 50e47d39-2adf-4df9-b5ee-c10ceaa1861b ^[metadata.json]
• Source: OpenCTI / MalwareBazaar
• PuTTY official site: https://www.chiark.greenend.org.uk/~sgtatham/putty/
• Related wiki pages: unclassified-dotnet, stolen-certificate-signing, version-info-masquerade

Provenance

• file.txt — file(1) output (PE32 Mono/.Net assembly)
• exiftool.json — ExifTool v12.76 PE metadata extraction
• pefile.txt — pefile Python library full PE header/resource/section dump
• rabin2-info.txt — radare2 rabin2 -I binary info (lang=cil, signed=true, overlay=true)
• strings.txt — strings -n 4 ASCII/Unicode extraction (1,930 lines)
• floss.txt — FireEye flare-floss (execution failed due to CLI argument error)
• capa.txt — Mandiant flare-capa v7 static analysis
• binwalk.txt — binwalk -e embedded artifact scan
• yara.txt — YARA generic PE rule match only
• dynamic-analysis.md — CAPE sandbox: skipped (no Windows guest)
• Custom Python scripts — .NET metadata table parsing (Module, TypeRef, TypeDef, MethodDef, MemberRef, AssemblyRef, ManifestResource)
• Manual certificate parsing — PKCS#7 SignedData extraction from IMAGE_DIRECTORY_ENTRY_SECURITY